CVE-2025-71274High· 7.8▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: rpmsg: core: fix race in driver_override_show() and use core helper The driver_override_show function reads the driver_override string without holding the device_lock.…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.10%
0.10% → 0.1%
In the Linux kernel, the following vulnerability has been resolved:
rpmsg: core: fix race in driver_override_show() and use core helper
The driver_override_show function reads the driver_override string without holding the device_lock. However, the store function modifies and frees the string while holding the device_lock. This creates a race condition where the string can be freed by the store function while being read by the show function, leading to a use-after-free.
To fix this, replace the rpmsg_string_attr macro with explicit show and store functions. The new driver_override_store uses the standard driver_set_override helper. Since the introduction of driver_set_override, the comments in include/linux/rpmsg.h have stated that this helper must be used to set or clear driver_override, but the implementation was not updated until now.
Because driver_set_override modifies and frees the string while holding the device_lock, the new driver_override_show now correctly holds the device_lock during the read operation to prevent the race.
Additionally, since rpmsg_string_attr has only ever been used for driver_override, removing the macro simplifies the code.
linux_kernel >= 4.18, < 5.10.252linux_kernel >= 5.11, < 5.15.202linux_kernel >= 5.16, < 6.1.165linux_kernel >= 6.2, < 6.6.128linux_kernel >= 6.7, < 6.12.75linux_kernel >= 6.13, < 6.18.16linux_kernel >= 6.19, < 6.19.6Upgrade past the affected range:
linux_kernel 6.19.6Connected by shared product, vendor, weakness, or advisory.
CVE-2022-3564Medium· 5.5A vulnerability classified as critical was found in Linux Kernel
CVE-2022-3521Low· 2.6A vulnerability has been found in Linux Kernel and classified as problematic
CVE-2022-3303Medium· 4.7A race condition flaw was found in the Linux kernel sound subsystem due to improper locking
CVE-2022-2959High· 7.0A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring()
CVE-2022-3028High· 7.0A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously
CVE-2022-1462Medium· 6.3An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem